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DELAYED STORAGE OF COOKIES WITH APPROVAL CAPABILITY 
BACKGROUND OF THE INVENTION 

5 1. Technical Field: 

The present invention relates generally to an 
improved data processing system. Still more 
particularly, the present invention relates to the 
storage of cookie files on a user's computer system. 

10 

2. Description of Related Art: 

The Internet, also referred to as an "internetwork", 
is a set of computer networks, possibly dissimilar, joined 
together by means of gateways that handle data transfer 

15 and the conversion of messages from protocols of the 
sending network to the protocols used by the receiving 
network (with packets if necessary) . When capitalized, 
the term "Internet" refers to the collection of networks 
and gateways that use the TCP/IP suite of protocols. 

20 The Internet has become a cultural fixture as a 

source of both information and entertainment. Many 
businesses are creating Internet sites as an integral part 
of their marketing efforts, informing consumers of the 
products or services offered by the business or providing 

25 other information seeking to engender brand loyalty. Many 
federal, state, and local government agencies are also 
employing Internet sites for informational purposes, 
particularly agencies, which must interact with virtually 
all segments of society such as the Internal Revenue 

30 Service and secretaries of state. Providing informational 
guides and/or searchable databases of online public 
records may reduce operating costs. Further, the Internet 
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is becoming increasingly popular as a medium for 
commercial transactions. 

Currently, the most commonly employed method of 
transferring data over the Internet is to employ the World 
5 Wide Web environment, also called simply "the Web". Other 
Internet resources exist for transferring information, 
such as File Transfer Protocol (FTP) and Gopher, but have 
not achieved the popularity of the Web. In the Web 
environment, servers and clients effect data transaction 
10 using the Hypertext Transfer Protocol (HTTP) , a known 

ft 

protocol for handling the transfer of various data files 
£8 (e.g., text, still graphic images, audio, motion video, 

jjj etc.). The information in various data files is formatted 

W for presentation to a user by a standard page description 

15 language, the Hypertext Markup Language (HTML) . In 
;L addition to basic presentation formatting, HTML allows 

% developers to specify "links" to other Web resources 

^ identified by a Uniform Resource Locator (URL) . A URL is 

H a special syntax identifier defining a communications path 

r= 20 to specific information. Each logical block of 

information accessible to a client, called a "page" or a 
"Web page", is identified by a URL. The URL provides a 
universal, consistent method for finding and accessing 
this information, not necessarily for the user, but mostly 
25 for the user' s Web "browser" . A browser is a program 

capable of submitting a request for information identified 
by an identifier, such as, for example, a URL. A user may 
enter a domain name through a graphical user interface 
(GUI) for the browser to access a source of content. The 
30 domain name is automatically converted to the Internet 

Protocol (IP) address by a domain name system (DNS), which 
is a service that translates the symbolic name entered by 
the user into an IP address by looking up the domain name 
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in a database. The HTML file also contains data, which 
may not be displayed at the browser. This "hidden" data 
may be used to store information or execute programs 
without the user's knowledge of the existence or purpose 
5 of the information or program. 

A hidden data field, which may be included in the 
HTTP header of an HTML file, is a "cookie" data field. A 
cookie is an HTTP protocol header document element, which 
may be used to provide multiple data elements to the 
10 browser. Server sites do one of three things: (1) does 
' v i not send cookies; (2) sends transient cookies; and (3) 

C3 sends persistent cookies. Some cookies may be specified 

¥i by the server site as persistent, implying that they will 

Id be stored on the user's hard drive and remain available 

ji 15 even if the user closes the browser or reboots the 
5 machine. Other cookies are transient and will only 

persist while the current browser session is open. In 
^ response to receiving an HTML file with a cookie, the 

% A browser may store the cookie data elements in a file, 

l f tl 20 which are usually kept in a profile directory for the 
browser. Also, a different cookie file may be present 
for each user profile (e.g. each person in a family can 
have their own profile on the same computer with their 
own cookie file) . These cookie data elements are also 
25 referred to as "cookies". Once a cookie is sent to the 
browser computer, the server expects the cookie to be 
returned in the HTTP header of subsequent messages sent 
from the browser to the server. The inclusion of the 
cookie in the HTTP header of messages from the browser is 
30 done without the user's awareness. In this manner, the 
operator of the server may identify repeat visitors to 
the server site. 

The Internet also is widely used to transfer 
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applications to users using browsers. With respect to 
commerce on the Web, individual consumers and businesses 
use the Web to purchase various goods and services. Some 
companies offer goods and services solely on the Web while 
5 others use the Web to extend their reach. A cookie 

provides a way for a Web site to keep track of a user's 
patterns and preferences, and potentially store the cookie 
on the user's computer. The storage of a cookie may be 
the unauthorized storage of data on another user's 
10 computer. The cookie may be used for tracking the user 

*;? and his or her requests for information from the server 

Q 

?!3 site without the user's knowledge or permission. 

Browsers typically accept all cookies as a default 

y option. A browser also may allow a user to disable the 

l 2 15. acceptance of cookies entirely. The browser may include 

5 an option to determine whether to accept cookies. While 

a ia 

H this option disables the acceptance of cookies, this 

M option does notify a user that a cookie was detected. A 

\l browser may also accept all cookies, but only return N 

H 20 cookies to the originating site. Browsers also have an 
"ask me each time" option. This option asks a user 
whether to accept a cookie every time a cookie is 
presented for acceptance. This option, however, becomes 
tiresome quickly. A user may receive three or four 
25 pop-ups on every Web page in which a yes or no response 
is required. 

Some Web sites may not function properly when the 
acceptance of cookies is disabled by the browser. 
Therefore, a user may not be able to access a Web site 
30 without having cookies accepted by the browser. 

The user basically has two options: 1) disable 
cookies and then not be able to talk to a vast number of 
Web sites (many of which the user trusts and does not 
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care if cookies are sent) or 2) enable cookies and get 
all of the downside of cookies. 

Therefore, it would be advantageous to have an 
improved method and apparatus for managing acceptance and 
storage of cookies on a data processing system. 
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SUMMARY OF THE INVENTION 



The present invention provides a method, apparatus, 
and computer instructions for managing cookies in a data 
processing system. A cookie is received during a browser 
program session. The cookie is only stored in a 
temporary data store within the data processing system ■ 
for a duration of the browser program session. The 
cookies stored in the temporary data store may be 
displayed in response to a signal to terminate the 
browser program session. Cookies are selectively stored 
in a persistent storage, based on user input. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

The novel features believed characteristic of the 
5 invention are set forth in the appended claims. The 

invention itself, however, as well as a preferred mode of 
use, further objectives and advantages thereof, will best 
be understood by reference to the following detailed 
description of an illustrative embodiment when read in 
10 conjunction with the accompanying drawings, wherein: 
*Z Figure 1 is a pictorial representation of a data 

f\ processing system in which the present invention may be 

jjlj implemented in accordance with a preferred embodiment of 

* jJ the present invention; 

s ;* 15 Figure 2 is a block diagram of a data processing 

I- system in which the present invention may be implemented; 

4 Figure 3 is a block diagram of a browser program m 

v accordance with a preferred embodiment of the present 

U 

O invention; 

r * 20 Figure 4 is a diagram of components used in managing 

receipt and storage of cookies in accordance with a 
preferred embodiment of the present inventions- 
Figure 5 is a menu displaying a list of cookies in 
which the present invention may be implemented; 
25 Figure 6 is a flowchart of process for managing 

receipt of cookies in accordance with a preferred 
embodiment of the present invention; and 

Figure 7 is a flowchart of method for processing 
cookies in accordance with a preferred embodiment of the 
30 present invention. 
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DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 



I -J 

Q 



hi 



With reference now to the figures and in particular 
5 with reference to Figure 1, a pictorial representation of 
a data processing system in which the present invention 
may be implemented is depicted in accordance with a 
preferred embodiment of the present invention. A 
computer 100 is depicted which includes a system unit 
10 102, a video display terminal 104, a keyboard 106, 

storage devices 108, which may include floppy drives and 
other types of permanent and removable storage media, and 
C5 mouse 110. Additional input devices may be included with 

m personal computer 100, such as, for example, a joystick, 

15 touchpad, touch screen, trackball, microphone, and the 
p like. Computer 100 can be implemented using any suitable 

•'f computer, such as an IBM RS/6000 computer or 

g IntelliStation computer, which are products of 

^ International Business Machines Corporation, located in 

20 Armonk, New York. Although the depicted representation 
shows a computer, other embodiments of the present 
invention may be implemented in other types of data 
processing systems, such as a network computer. Computer 
100 also preferably includes a graphical user interface 
25 that may be implemented by means of systems software 

residing in computer readable media in operation within 
computer 100. 

With reference now to Figure 2, a block diagram of a 
data processing system is shown in which the present 
30 invention may be implemented. Data processing system 200 
is an example of a computer, such as computer 100 in 
Figure 1, in which code or instructions implementing the 
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processes of the present invention may be located. Data 
processing system 200 employs a peripheral component 
interconnect (PCI) local bus architecture. Although the 
depicted example employs a PCI bus, other bus 
5 architectures such as Accelerated Graphics Port (AGP) and 
Industry Standard Architecture (ISA) may be used. 
Processor 202 and main memory 204 are connected to PCI 
local bus 206 through PCI bridge 208. PCI bridge 208 also 
may include an integrated memory controller and cache 

... 10 memory for processor 202. Additional connections to PCI 

Q 

\'H local bus 206 may be made through direct component 

f a 

>• interconnection or through add-in boards. In the depicted 

C8 example, local area network (LAN) adapter 210, small 

m computer system interface (SCSI) host bus adapter 212, and 

?;; 15 expansion bus interface 214 are connected to PCI local bus 
p 206 by direct component connection. In contrast, audio 

adapter 216, graphics adapter 218, and audio/video adapter 
O 219 are connected to PCI local bus 206 by add-in boards 

It inserted into expansion slots. Expansion bus interface 

20 214 provides a connection for a keyboard and mouse adapter 
220, modem 222, and additional memory 224. SCSI host bus 
adapter 212 provides a connection for hard disk drive 226, 
tape drive 228, and CD-ROM drive 230. Typical PCI local 
bus implementations will support three or four PCI 
25 expansion slots or add- in connectors. 

An operating system runs on processor 202 and is used 
to coordinate and provide control of various components 
within data processing system 200 in Figure 2. The 
operating system may be a commercially available operating 
30 system such as Windows 2000, which is available from 
Microsoft Corporation. An object oriented programming 
system such as Java may run in conjunction with the 
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operating system and provides calls to the operating 
system from Java programs or applications executing on 
data processing system 200. "Java" is a trademark of Sun 
Microsystems, Inc. Instructions for the operating system, 
the object-oriented programming system, and applications 
or programs are located on storage devices, such as hard 
disk drive 226, and may be loaded into main memory 204 for 
execution by processor 202. 

Those of ordinary skill in the art will appreciate 
that the hardware in Figure 2 may vary depending on the 
implementation. Other internal hardware or peripheral 
devices, such as flash ROM (or equivalent nonvolatile 
memory) or optical disk drives and the like, may be used 
in addition to or in place of the hardware depicted in 
Figure 2. Also, the processes of the present invention 
may be applied to a multiprocessor data processing 
system. 

For example, data processing system 200, if 
optionally configured as a network computer, may not 
include SCSI host bus adapter 212, hard disk drive 226, 
tape drive 228, and CD-ROM 230, as noted by dotted line 
232 in Figure 2 denoting optional inclusion. In that 
case, the computer, to be properly called a client ' 
computer, must include some type of network communication 
interface, such as LAN adapter 210, modem 222, or the 
like. As another example, data processing system 200 may 
be a stand-alone system configured to be bootable without 
relying on some type of network communication interface, 
whether or not data processing system 200 comprises some 
type of network communication interface. As a further 
example, data processing system 200 may be a personal 
digital assistant (PDA), which is configured with ROM 



Docket No. AUS920010146US1 

and/or flash ROM to provide nonvolatile memory for 
storing operating system files and/or user-generated 
data . 

The depicted example in Figure 2 and above-described 
5 examples are not meant to imply architectural 

limitations. For example, data processing system 200 also 
may be a notebook computer or hand held computer in 
addition to taking the form of a PDA. Data processing 
system 200 also may be a kiosk or a Web appliance. 
10 The processes of the present invention are performed 

f : i 

\J by processor 202 using computer implemented instructions, 

ft which may be located in a memory such as, for example, 

£3 main memory 204, memory 224, or in one or more peripheral 

Id 

£K devices 226-230. 

°<* 15 Turning next to Figure 3, a block diagram of a 

p browser program is depicted in accordance with a 

preferred embodiment of the present invention. A browser 
is an application used to navigate or view information or 

^ data in a distributed database, such as the Internet or 

H 

20 the World Wide Web. 

In this example, browser 300 includes a user 
interface 302, which is a graphical user interface (GUI) 
that allows the user to interface or communicate with 
browser 300. This interface provides for selection of 

25 various functions through menus 304 and allows for 

navigation through navigation 306. For example, menu 304 
may allow a user to perform various functions, such as 
saving a file, opening a new window, displaying a 
history, and entering a URL. Navigation 306 allows for a 

30 user to navigate various pages and to select web sites 
for viewing. For example, navigation 306 may allow a 
user to see a previous page or a subsequent page relative 
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to the present page. Preferences such as those 
illustrated in Figure 3 may be set through preferences 
308. 

Communications 310 is the mechanism with which 

5 browser 300 receives documents and other resources from a 
network such as the Internet. Further, communications 
310 is used to send or upload documents and resources 
onto a network. In the depicted example, communication 
310 uses HTTP. Other protocols may be used depending on 

10 the implementation. The mechanism of the present 
invention may be implemented as processes within 
communication 310 to manage cookies as they are received 
for storage from sources, such as Web sites that send 
documents and other content to a user of browser 300. 

15 Documents that are received by browser 300 are 

processed by language interpretation 312, which includes 
an HTML unit 314 and a JavaScript unit 316. Language 
interpretation 312 will process a document for 
presentation on graphical display 318. In particular, 

20 HTML statements are processed by HTML unit 314 for 

presentation while JavaScript statements are processed by 
JavaScript unit 316. 

Graphical display 318 includes layout unit 320, 
rendering unit 322, and window management 324. These 

25 units are involved in presenting web pages to a user 
based on results from language interpretation 312. 

Browser 300 is presented as an example of a browser 
program in which the present invention may be embodied. 
Browser 300 is not meant to imply architectural 

30 limitations to the present invention. Presently available 
browsers may include additional functions not shown or 
may omit functions shown in browser 300. A browser may 
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be any application that is used to search for and display 
content on a distributed data processing system. Browser 
300 make be implemented using known browser applications, 
such as Netscape Navigator or Microsoft Internet 
5 Explorer. Netscape Navigator is available from Netscape 
Communications Corporation while Microsoft Internet 
Explorer is available from Microsoft Corporation. 

The present invention accepts all cookies with an 
only-return-to-originator option if desired. The browser 
10 will basically tell the server that it is accepting and 
]t storing all persistent cookies on the hard drive. Thus, 

(3 the server sees no difference. The browser, however, 

does not actually write these persistent cookies to the 
file until later. The user may then view the list of 
15 cookies that are scheduled to be written and choose to 
save or discard them. If the browser closes before 
writing the cookies, they are all discarded. Not writing 
cookies simply makes the server think the user is a 
first-time visitor the next time the user visits that 
20 site, which likely is the precise intent of the user. 

With reference to Figure 4, a diagram of components 
used in managing receipt and storage of cookies is 
depicted in accordance with a preferred embodiment of the 
present invention. The browser issues a request to a 
25 server and the server responds with a response. The 

response may contain a cookie, and the accepted protocol 
is that the browser will dutifully keep up with that 
cookie (either permanently or temporarily as specified by 
the type of cookie) . Response 400 may be sent to browser 
30 402. In these examples, response 400 is a HTTP response 
made in response to browser 402. When response 400 
contains cookie 404, cookie 404 may be stored in permanent 
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storage 406 or in temporary memory 408. In these 
examples, memory 408 is system memory in a data processing 
system, such as main memory 204 in Figure 2. Memory 408 
is used as a temporary data store in these examples. When 

5 stored in permanent storage 406, cookie 404 is typically 
placed in a file, such as cookie file 410 for use by 
browser 402. Permanent storage 406 may take various forms 
depending on the implementation, such as, for example, 
hard disk drive, an optical disc, or a flash memory. 

10 Normally, browser 402 receives a request, such as 

response 400 to accept cookie 404. Upon accepting cookie 
404, this cookie is normally placed into cookie file 410 
as well as in temporary memory 408 for use during the 
session in which the user makes requests through browser 

15 402 for various content, such as Web pages, audio files, 
or images. A session is the time from which browser 402 
starts execution to the time at which browser 402 
terminates execution. 

The present invention provides a method, apparatus, 

20 and computer implemented instructions for handling cookies 
received at browser 402. This invention does not address 
the transient cookies, only the persistent cookies. The 
mechanism of the present invention accepts all cookies 
presented to browser 402 without saving all of the cookies 

25 in permanent storage 406. The cookies are stored in 

temporary memory 408 in this example for use while browser 
402 is executing. When execution of browser 402 is to be 
terminated all cookies within temporary storage are 
presented to a user. Selected cookies may be stored in 

30 cookie file 410 within permanent storage 406 in response 
to a user input selecting these cookies for retention. 
Other cookies within temporary memory 408 are discarded. 
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With reference to Figure 5, a menu displaying a list 

of cookies is shown in which the present invention may be 

implemented. Menu 500 includes check boxes 502-510 

associated with fields 512-520 with each field identifying 

5 a cookie that has been received during the current 

session. In these examples, the identifications of 

cookies in fields 512-520 are obtained from the URLs for 

the source of the cookies. Of course other identifiers 

may be used depending on the particular implementation. 

10 In this example, the user accepts a cookie that has 

been passed to the user's computer system by entering a 

^ mark in a check box next to the cookie to be permanently 

I J 

stored. Cookies not marked by the user in menu 500 are 
discarded. In this manner, the user is able to store the 
15 selected cookies and disregard the rest of the cookies. 
The user may decide to save all of the cookies, some of 
the cookies, or none of the cookies through menu 500. 
When the user has finished making selections in menu 500, 
those selections may be accepted by pressing "Okay" button 
20 522. The selections may be discarded by pressing "Cancel" 
button 524. 

Turning to Figure 6, a flowchart of a process for 
managing receipt of cookies is depicted in accordance with 
a preferred embodiment of the present invention. The 
25 process illustrated in Figure 6 may be implemented in a 
browser, such as browser 300 in Figure 3. 

During the current session, a determination is made 
as to whether a cookie has been received (step 600) . If a 
cookie is not received, the process returns to step 600. 
30 When a cookie is received, the cookie is prevented from 

being permanently stored in a cookie file (step 602) . The 
cookie is stored in a temporary storage, such as a 



C3 



UJ 

Id 
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temporary file or temporary memory 408 in Figure 4. In 
these examples, the cookie is not stored in a file 
normally used to retain cookies for the browser. The 
cookie is tagged as accepted (step 606) . A protocol is 
5 present that is used by the browser/server to determine 
capabilities. However, once the capabilities have been 
established and the browser has indicated that it accepts 
cookies, then the server simply sends them with the 
understanding that the browser is going to handle them. 
10 This handling of the cookie allows for it to be used in 
J;j requests made to a Web site, dependent upon that cookie, 

W to operate properly. A determination is made as to 

£3 whether the current session has been requested to be 

^{ terminated (step 608) . The session terminates when the 

5.: : 

15 execution of the browser ends. Execution of the browser 
L 1 ends, in these examples, when the user clicks "close". If 
=S the current session is not in the act of being terminated, 

£j process returns to step 600 as described above. 

P Otherwise, the cookies are processed (step 610) . Step 610 

20 happens once the browser has requested to close the 

session, but before the browser is actually terminated. 
The processing of the cookies involves presenting received 
cookies to the user to determine which cookies, if any, 
should be retained. The user may request to process the 
25 cookie list at any time and continue to use the browser 
afterwards. Closing the browser forces the processing of 
the cookies using the mechanism of the present invention. 
A user option is present to initiate these processes at 
any other time. 

30 As represented in Figure 7, a flowchart of a method 

for processing cookies is depicted in accordance with a 
preferred embodiment of the present invention. The 
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process depicted in Figure 7 is a more detailed 
description of step 610 in Figure 6. 

The process begins by generating a list of cookies 
received in the current session (step 700) . The list of 
5 cookies from the current session is displayed to the user 
(step 702) . User input is received to indicate which 
cookies to store in a permanent storage, such as 
permanent storage 406 in Figure 4 (step 704) . The 
cookies marked for permanent storage, as depicted in 
10 Figure 5, are identified (step 706) . The identified 
□ cookies are then saved in permanent storage, a cookie 

file, database, registry, or wherever the browser stores 
CO persistent data (step 708) . Cookies that are not marked 

i . 1 

jl* for permanent storage are discarded (step 710) with the 

15 process terminating thereafter. 
f'3 Thus, the present invention provides a method, 

* : ° apparatus, and computer implemented instructions to delay 

the permanent storage of cookies received from another 
p computer until the user approves the permanent storage, 

20 The mechanism of the present invention affords the user 
the opportunity to view and approve the permanent storage 
of cookies on the user's computer. The mechanism accepts 
cookies or tag cookies as accepted is needed so that Web 
sites, which need the cookies, can function properly. 
25 The cookies are temporarily stored so that the data from 
the cookie is available to a Web site to allow the user 
to properly access Web sites requiring cookies. When the 
session for the browser terminates, part of the 
termination of the session includes presenting cookies 
30 received during the session to the user for a 

determination as to which cookie should be retained. 
Thus, the present invention provides a mechanism to 



ft 



5 .» 



Docket No. AUS920010146US1 

restrict access to resources on a user's computer. In 
this manner, the user is not required to approve the 
acceptance of a cookie each time a cookie is presented to 
the browser as in currently available systems. 

5 It is important to note that while the present 

invention has been described in the context of a fully 
functioning data processing system, those of ordinary 
skill in the art will appreciate that the processes of 
the present invention are capable of being distributed in 

10 the form of a computer readable medium of instructions 
and a variety of forms and that the present invention 



£3 applies equally regardless of the particular type of 

signal bearing media actually used to carry out the 



W distribution. Examples of computer readable media 

15 include recordable-type media, such as a floppy disk, a 
hard disk drive, a RAM, CD-ROMs, DVD-ROMs, and 
transmission-type media, such as digital and analog 
communications links, wired or wireless communications 
links using transmission forms, such as, for example, 
20 radio frequency and light wave transmissions. The 
computer readable media may take the form of coded 
formats that are decoded for actual use in a particular 
data processing system. 

The description of the present invention has been 
25 presented for purposes of illustration and description, 
and is not intended to be exhaustive or limited to the 
invention in the form disclosed. Many modifications and 
variations will be apparent to those of ordinary skill in 
the art. In the depicted examples, the cookie is 
30 presented as part of an HTTP request received at the 

browser. The mechanism of the present invention may be 
applied to other methods used to send cookies to a 
browser. For example, cookies embedded within HTML pages 
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or Java scripts also may be handled using the process of 
the present invention. In each case, the cookies will be 
accepted and placed in a temporary storage and not in a 
permanent storage without approval from the user at a 
time when the session ends. Of course, this presentation 
and approval process may occur at other times other than 
the termination of the session depending on the 
particular implementation. For example, the user may 
initiate an approval or review process of cookies 
received during a session. 

Further, the illustrated examples place the cookies 
in a temporary memory, such as a system random access 
memory. These cookies received during a session also may 
be placed in a other types of temporary storage, such as 
a temporary file that is deleted or emptied when the 
session terminates. The embodiment was chosen and 
described in order to best explain the principles of the 
invention, the practical application, and to enable 
others of ordinary skill in the art to understand the 
invention for various embodiments with various 
modifications as are suited to the particular use 
contemplated. 



